2026-09-02 01:05:41 +08:00
commit 04bac1f6e2
2200 changed files with 489415 additions and 0 deletions
@@ -0,0 +1,36 @@
# MCP OAuth conformance proof
Historical record: these screenshots were captured by the legacy `mcp-oauth-conformance` flow on
July 14, 2026 (America/Los_Angeles). The flow uses an isolated Den database and
OpenWork's local OAuth MCP conformance server; it does not use a third-party
service or pre-seeded connection.
The passing journey proves that:
1. URL-only requirements discovery reports OAuth, registration, scope, and
   administrator requirements without creating a connection or registering a
   client.
2. DCR identifies OpenWork as a web client, PKCE authorization completes, and
   the provider returns through the deployment-wide callback.
3. The normalized connection contract reports a connected dynamic client with
   the shared callback and selected scope.
4. The authorized tool is visible in the dashboard and works through
   `search_capabilities` and `execute_capability`.
5. At a 600px-tall viewport, the add-connection dialog remains fully bounded,
   switches to internal scrolling, and keeps the final action reachable. The
   run measured a 550px client height, 745px scroll height, `overflow-y: auto`,
   and dialog bounds from 24px to 576px.
The machine-readable assertions and voice-over coverage are recorded in
[report.md](./report.md). The durable end-to-end flow lives in
`evals/flows/mcp-oauth-conformance.flow.mjs`.
## Frames
![Requirements discovery](./mcp-oauth-conformance-01-requirements-discovered.png)
![Shared callback success](./mcp-oauth-conformance-02-shared-callback-connected.png)
![Normalized shared-callback connection](./mcp-oauth-conformance-03-dashboard-shared-callback.png)
![Authorized tool catalog](./mcp-oauth-conformance-04-authorized-tool-catalog.png)